Yes, especially in distributed environments, the search head must be aware of the index.  No storage needs to be created, however.  The SH merely needs to know the index exists. ... View more

Hi @SplunkExplorer , I usually use user splunk and I don't add it to sudoers, but I enabled ACL. Ciao. Giuseppe ... View more

HFs process data transparently so there's no way to track the flow of events.  Many customers work around that by having the HF add a field to every event where the value of the field is the HF's name. ... View more

Yes, it is good practice, to create a service account. As you said, people leave and KO's become orphaned. So, if you have a service account for say business critical app, you get the users/developers to create various private KO's for this app, then move/clone them to the main app and assign the KO's to the service account user. I don't know if having multiple services accounts is needed, but perhaps having one account per business critical app. The service account will need to have sufficient capabilities and resources based on its Splunk role and optionally you could look at workload management rules for the different roles for different workloads, so give the important service account that belongs to a role better performance than others. ... View more

Solved. The issue was related to this configuration sgement:   [serverClass:spoke_hf] whitelist.0 = <HF1_ip_address>, <HF1_ip_address> Searching better into documentation, I found that comma separated IP address list is not supported. After I switched to: whitelist.0 = <HF1 IP Address> whitelist.1 = <HF2 IP Address> Issue went away. ... View more

The LINE_BREAKER attribute requires at least one capture group and the text that matches the first capture group will be discarded and replaced with a event break.  Knowing this and that an empty capture group is allowed, try these settings:   [<sourcetype_name>] CHARSET=AUTO LINE_BREAKER = "platform":"ArcodaSAT"\}() SHOULD_LINEMERGE = false     ... View more

Hi @SplunkExplorer, You are right that is Deployment Server log but it should show client ip address too. You can use below search to check deployment steps on client; index=_internal host=YourClientHost sourcetype=splunkd (DeployedApplication OR ApplicationManager OR "Restarting Splunkd") You should see similar events on regarding host logs; INFO DeployedApplication - Checksum mismatch 0 <> 18281318892102154454 for app=your_app_name. Will reload from='x.x.x.x:8089/services/streams/deployment?name=default:your_serverclass_name:your_app_name' INFO DeployedApplication - Downloaded url=x.x.x.x:8089/services/streams/deployment?name=default:your_serverclass_name:your_app_name to file='C:\Program Files\SplunkUniversalForwarder\var\run\your_serverclass_name\your_app_name-1711990721.bundle' sizeKB=xx INFO DeployedApplication - Installing app=your_app_name to='C:\Program Files\SplunkUniversalForwarder\etc\apps\your_app_name' INFO ApplicationManager - Detected app creation:your_app_name WARN DC:DeploymentClient - Restarting Splunkd...    If everything seems ok on these log, we can think the problem is on provided path/filename.   ... View more

Solved by myself, underscores gives not problem. ... View more

First and foremost - don't receive syslogs directly on your Splunk component (UF or HF/idx). Its performance is sub-par, it doesn't capture reasonable metadata about the transport layer, it doesn't scale well - as you can see. But if you're trying to do it anyway, the easier way would be to simply send your events to separate ports and associate specific sourcetypes and indexes with specific ports. That's much easier to handle than this overwriting things. But if you insist on doing it this way, the most important thing to remember when analyzing such configurations is that: 1. Transform classes are ordered in alphabetical order (so TRANSFORMS-my_transforms_a will be used _after_ TRANSFORMS-aaaa_my_transforms_zzz) 2. Transforms within a single transform class are used in a left to right order. 3. In a simple configuration (without some fancy ruleset-based entries), _all_ matching transforms are "executed" - the processing isn't stopped just because you've already overwritten some particular metadata field. If any subsequent transform should overwrite the field it will. So in your configuration the TRANSFORMS-ot_nozomi should be executed resulting in some events redirected to the ot_nozomi index, then Splunk would execute the TRANSFORMS-ot_windows and redirect events to ot_windows (even if some of them have already been redirected to the ot_nozomi index - the destination index will get overwritten if they match both regexes).. It _should_ work this way. If it doesn't I'd check if there are no issues with either config file precedence or sourcetype/source/host precedence. ... View more

Found by myself: How Splunk Enterprise licensing works - Splunk Documentation ... View more

Hi I suppose that you means that the currentTimePeriodDay is the oldest data what you have on bucket before it has moved to frozen state. I suppose that this apps use those two values to check how well date retention is working. I expecting that you are familiar how data has stored on splunk bucket and which all parameters need to take count when real retention (remove bucket and events) will happened? If not then there are couple of old post where we have discussed this challenge. Also there is a good .conf presentation about it https://conf.splunk.com/files/2017/slides/splunk-data-life-cycle-determining-when-and-where-to-roll-data.pdf I suppose that you could use this apps and those limits to fine-tune needed parameters in indexes.conf file to ensure that your real event retention time is as close as possible what you have defined in indexes.conf. r. Ismo ... View more